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|, Mr. Brett A. Roberson, declare under penalty of perjury, as follows: 


|. Background and Qualifications 

1. lama Director at AlixPartners, LLP (AlixPartners), a global business consulting firm, 
where | have been a senior member of the computer forensics investigation team since 
2007. 

2. | began my digital forensics career in 2005 with Deloitte’s computer forensic 
investigations practice group, and since that time have been providing federal, state, 
local and tribal courts and governments, along with companies around the world, with 
digital forensics and related investigative services. | earned a bachelor’s degree in 
Business Administration and International Studies from Abilene Christian University, in 
Abilene, Texas. | hold and have held several digital forensic and technology 
certifications including the CISSP and Guidance Software’s EnCase® Certified Examiner 
(EnCE) for which | am currently in process of recertifying. | am also a Licensed Private 
Investigator in the State of Texas, where | am based. A copy of my curriculum vitae is 
provided at the end of this declaration as Attachment 01. 

3. In preparing this declaration, | received and have reviewed the following documents, 
and am familiar with their content; 

a. ECF No. [144-1], submitted at Exhibit A to Defendant DR. WRIGHT’S MOTION 
FOR JUDGMENT ON THE PLEADINGS FOR LACK OF SUBJECT-MATTER 


JURISDICTION 


Case 9:18-cv-80176-BB Document 171-2 Entered on FLSD Docket 05/06/2019 Page 3 of 7 


4. 


b. ECF No [159-9], AFFIDAVIT OF DR. MATTHEW J. EDMAN, submitted in support of 
PLAINTIFFS’ MEMORANDUM IN OPPOSITION TO DEFENDANT’S MOTION FOR 
JUDGMENT ON THE PLEADINGS FOR LACK OF SUBJECT-MATTER JURISDICTION 

| understand ECF No. [144-1]to be a copy of a hard copy document, which is an email 
message from David Kleiman to Uyen Nguyen and appears to have been digitally signed 
using Pretty Good Privacy compatible (“PGP”) encryption software tools, such as 
GnuPGP, that use the OpenPGP standard (RFC 4880). 

As described by Dr. Edman in his declaration, the digital signature found at the bottom 
of ECF No [144-1] contains an encoded timestamp that can be read after conversion and 
decoding of the signature block’s data. (ECF No [159-9], 4] 15). 

As Mr. Edman further states, this timestamp “records the time the alleged email was 
signed according to the computer on which the signature was created.” (ECF No [159- 
9], 1 23 & | 27, emphasis added). In other words, the time of creation is set by the 
OpenPGP software to match the date and time of the system or operating system clock 
on the computer being used to create the signature block. 

While one might assume that the date stamp inserted into a PGP signature represents 
the actual date and time the stamp was created, there is no way to ensure that this is in 
fact true. Depending on the system or operating system settings of the computer used 
to create it, this can be just about any date and time imaginable. This is a commonly 
known weakness of OpenPGP encryption tools and is the reason trusted third parties 


called Time Stamping Authorities (TSAs) exist. 
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8. There are many variables that can lead to an OpenPGP signature time stamp not 
reflecting an accurate date or time. Certain technical issues can lead to inaccurate 
system clocks which will cause an inaccurate date and time in the stamp. Some 
OpenPGP-based software packages also contain functionality to allow users to set the 
date and time in the stamp to a desired setting. These are but two examples of many. 
This simply means that the date and time placed on it may not have been accurate as of 
the date and time placed. 

9. Like the PGP timestamp, the data and time commonly displayed at the top of printed 
email communications can also change when messages are displayed on different 
computers and when converted to different digital file formats, such as when printing 
an email to a PDF file or to hardcopy. Changes to the system clock settings on the 
computer displaying the email, or printing it, can also have an impact on the displayed 
date. 

10. However, given that ECF No. [144-1] is a printout of a scanned hardcopy document and 
not the original electronic email communication file, the exhibit document does not 
contain any of the metadata that would be typically found in an electronic email header, 
and which would be used to validate the sent and received times. 

11. Further the document purports to be an electronic email communication between Dave 
Kleiman and Uyen Nguyen. Craig Wright was not a party to this communication. 
Therefore, without the original electronic email, it is not possible to verify the date of 


the email exchange. 
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12. Finally, it was, and remains, common practice for users experienced in computer 
security, as Dave Kleiman was, to only run their PGP software programs on ‘air-gapped’ 
computers which are not connected to the internet in order to protect their private keys 
from cyber theft. In such an instance a user would create the signed message on the air- 
gapped PC with the PGP software using the text editing function of that software, and 
then transfer the output of the PGP software to a different PC and paste it into the 
message body of an email message for transmission. If the system clocks on these two 
PCs were set to different dates and times, the date and time displayed in the email 


header would differ from the data and time embedded in the PGP signature time stamp. 


Dated: May 6, 2019 


BAK 


Brett A. Roberson 
AlixPartners, LLP - Dallas, TX 
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AlixPartners cmc 


POSITION 


EDUCATION 


PROFESSIONAL 
HISTORY 


PROFESSIONAL 
EXPERIENCE 


RANGE OF 
EXPERIENCE 


Brett A. Roberson 
Texas Licensed Qualified Manager & 
Private Investigator # 816698 


Director, AlixPartners, LLP, Dallas, Texas 


B.A. in Business Administration and International Studies, Abilene 
Christian University 


Mr. Roberson has more than nineteen years of experience in 
information technology and as a forensic investigator and manager. 
Beginning in 2005, he has continuously provided computer forensic 
consulting and electronic discovery services for many matters. Mr. 
Roberson has a wide range of experience with information 
technology infrastructure and security, forensic acquisition and 
forensic analysis, including computer tampering, contractual disputes, 
employment matters, network intrusions, intellectual property theft, 
and fraud. 


Mr. Roberson has extensive experience providing design and 
installation of information technology infrastructures and network 
security administration. He has provided technical expertise in 
criminal and civil investigations. As a Director for a global 
consulting firm, Mr. Roberson has been tasked with development of 
policies and procedures, case management, quality control 
workflows and resource allocation. 


Mr. Roberson has performed a variety of services related to computer 
forensics and investigations. A sample of these includes: 
e Computer forensics investigations 
Detection of intellectual property theft 
Analysis of a computer user's actions over specific time periods 
Recovery of deleted files 
Defensible forensic collection of ESI 
Filtering and searching for responsive documents and the de- 
duplication of mass ESI 
e Client site assessment of ESI, assistance with identification of 
items potentially responsive to eDiscovery obligations 
e Remote forensic imaging and analysis 


2101 Cedar Springs Road | Suite 1100 | Dallas, TX | 75201 | 214.647.7500 | 214.647.7501 fax | www.alixpartners.com 
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ACCREDITATIONS 
AND LICENSES 


ADDITIONAL 
TRAINING AND 
EDUCATION 


Brett A. Roberson 
PAGE 2 


EnCase® Certified Examiner (EnCE), Guidance Software — 
Recertification in Process 

CCE Certification in Process 

Licensed Private Investigator, Qualifying Manager - Computer Forensics, 
State of Texas (ALIXPARTNERS FORENSIC SERVICES, LLC - 
License #A 14892) 


Magnet Axiom Investigations 

Apple iOS Mobile Forensics, Blackbag Technologies 

Intermediate Apple OSX Hardware and Software Forensics — Blackbag 
Technologies 

EnCase NTFS, Guidance Software 

CISSP Training and Certification (Does Not Possess Cert Post-Expiry) 
EnCase Advanced Internet & Email Examinations, Guidance Software 
EnCase Internet & Email Examinations, Guidance Software 

EnCase Intermediate Computer Forensics, Guidance Software 

EnCase Level 1 Computer Forensics, Guidance Software 

Interrogation and Elicitation Techniques, BIA 

Private Investigations Skip Tracing, Surveillance and Interrogation and 
Elicitation Techniques, PIEducation 

Intermediate Microsoft SQL Training - LearningTree 


2101 Cedar Springs Road | Suite 1100 | Dallas, TX | 75201 | 214.647.7500 | 214.647.7501 fax | www.alixpartners.com 


